start	end	text
3040	6720	Welcome to the Ethics Village. I'm Andrea Matwishan from Penn State,
6720	11440	and we are incredibly lucky to have with us today Liesl Bogan from Tech Congress.
11440	16180	Welcome, Liesl. Thank you for having me. I'm so excited. Thanks for joining us.
16180	21900	So I'm gonna not talk at all after this, but if you wouldn't mind just telling us
21980	25480	a little bit about yourself, how you got involved with tech policy, some of the
25480	29220	exciting jobs you've had, and what you've learned from them, and
29220	32040	how someone who's interested in following in your footsteps
32040	37280	might be able to also get involved in tech policy work. And then after that,
37280	43020	I look forward to your talk. Great. Thank you so much. Well, I have been
43020	46740	working in technology for quite a while, but I didn't start there.
46740	50840	My original intent was to do more global affairs, foreign policy work,
50840	55400	and I did some of that, but I began working in new media technologies
55400	61100	out of grad school, and then I was able to do a research fellowship
61100	66400	at Stanford University, originally on international institutions, but then
66400	72500	I began work on cybersecurity through that research, and we did a number
72500	75240	of projects related to cybersecurity and technology.
75720	80040	And then at the same time, when former Secretary of State Condoleezza Rice
80040	85820	was coming out of office, she hired me to start with her a new consulting
85820	89220	firm, and it was a boutique consulting firm, and it had technology
90120	94860	clients from the Silicon Valley and large international banks and other
94860	100520	organizations that needed help navigating complex challenges in emerging
100520	103620	markets all over the world. So I was able to combine some of my
103620	107480	economics background with this new technology expertise that I had to
107480	112240	help do strategies for clients. At the same time, I was doing research
112240	115940	at Stanford in a number of areas, particularly focused on cybersecurity.
115940	120520	And then after that, I went to a tech company for a bit, and from there,
120520	125680	I went back to Stanford. I was doing a lot of tech policy advising from
125680	129280	that perspective because I had worked with senior government officials
129280	133440	because the consulting firm was with former National Security Advisor
133940	138980	Steve Hadley and former Secretary of Defense Robert Gates, and so the
138980	144520	firm was Rice-Hadley-Gates. And so at Stanford, I was briefing members
144520	148300	of Congress on big data issues, privacy, technology, and national
148300	153720	security. And then from there, I went back to the private sector where I
153720	157680	worked on global strategy for cybersecurity at a large professional
157680	162080	services firm. And then following three years of that work and recognizing
162080	166160	the importance of technology in the entire infrastructure in which we
166160	173960	operate as citizens, I was compelled to join Tech Congress, which is a
173960	179020	career technologist on the Hill. The fellowship is called the Congressional
179020	182780	Innovation Fellowship, and I was a senior fellow in the office of
182780	186880	Senator Mark Warner last year, and I advised and supported on national
186880	192840	security issues, cybersecurity, and technology. After that, I was hired by
192840	196640	Tech Congress to lead a new initiative by the organization, which is called
196640	200800	the Congressional Digital Service, and that is an attempt to place
200800	205680	developers on the Hill to help Congress deal with the COVID crisis
205680	210900	currently. And I've been working in this research space for a long time,
210900	214700	and I'm very excited to discuss cybersecurity and disinformation and
215220	219840	some of the tactics and methods that are currently in use today, but also the
219840	224560	legislative efforts to counter them. So with that, I will share... oh, how can
224560	227760	you get interested? Sorry, I left that out. How can those of you who are
227760	230380	interested in getting into this space? There are a number of ways you can do
230380	234720	that. I think finding mentors is extremely important.
234720	237400	I was really fortunate to have incredible mentors who
237400	240780	pointed me in different directions than I may have thought of myself.
240800	244040	Secondly, I think if you can look for fellowships
244040	248040	or research internships or ways to sort of get in on the ground floor, it's
248040	251420	really important. In terms of technology development, if
251420	254660	you don't have tech skills, there are plenty of boot camps you can join. If you
254660	260360	don't want to do a formal degree, you can take classes online. There are a
260360	262520	lot of different courses that will teach you how to do information security
262520	266940	or programming or coding from a variety of different perspectives
266940	270400	and disciplines. I think getting involved in the
270400	274820	information security ecosystem in terms of...
274820	277800	there's a lot of InfoSec people on Twitter and
277800	282780	on blogs and think tanks. I would also encourage you to look into
282780	285900	Civic Tech, which is something I wasn't really familiar with until I was
285900	288980	introduced to Tech Congress. But this is a group of technologists who
288980	292200	are trying to work to make technology work better for the public.
292200	295700	And I think that's a really important initiative and really important effort
296220	299900	and something that I am committed to. Because I think the last few years have
299900	303820	shown us technology can be an incredible force multiplier for good, but it can also
303820	307220	be something that does quite a bit of bad in the world. And so
307760	311000	belonging to organizations that are really looking at things from an ethical
311520	315880	and public service perspective is really important and I think incredibly
315880	319660	valuable. So that's... that would be my advice and
319660	322100	feel free to contact me if you have any other questions.
322120	334350	I'm going to share my screen. So we're going to talk about
334350	337890	disinformation and security. These are obviously two different
338390	340550	disciplines, but I'm going to talk about how they
340550	344490	intersect and then what we do with them from a legislative perspective.
344610	347390	I'll briefly give you a history of disinformation,
347390	351370	some of the methods and tactics that are used, why
351370	354930	I think we should take a more of a security versus a content approach
354930	358750	to the problem, some of the global regulatory efforts that are in use
358750	361070	today, and then what the U.S. regulatory
361070	367470	approach to methods and tactics is currently. So the history of
367470	372170	disinformation is very old. It goes back into the
372170	377290	1800s. Russia had monitored all internal and external communications, including
377290	381850	those clear way back until
381850	387430	way back until they were in the tsars. In the 19th century, Russia, the
387430	391110	Ministry of Internal Affairs had a cryptanalytic division that
391110	393910	analyzes encrypted, potentially anti-tsarist
393910	398210	communications using code books that were purchased on the black market.
398210	401870	This sort of dark information market existed not just in Russia but elsewhere,
401870	404690	but they were quite good at organizing it.
404690	408870	Tsar Alexander I gave credit to a Russian cryptanalyst for the defeat of
408870	412710	Napoleon way back in 1812. Although by
412710	419670	the early 1900s, Russian cryptography was far superior to
419670	423250	any other world power, some of their disinformation tactics
424550	428070	developed by the Russians after World War II were then gleaned
428070	431890	from Russia by the military, German military,
431890	436110	and the German military had a division that was dedicated to creating
436110	439790	false military plans that were intended to confuse
439790	443790	the enemy. So some people will trace disinformation efforts to
444530	448150	Nazi Germany. The Russian word for disinformation
448150	454370	includes all deception, except for camouflage. They made an
454370	456370	exception for camouflage, but it meant any type of
456370	460810	deception, and it quickly became part of their military operations
461530	465590	with the intent to confuse and pollute the opinion-making process
465590	470210	in the West. Many Russians believe that the dissolution of the Soviet Union was
470210	472130	due to a deliberate information attack
472130	477230	perpetrated by the West, and Timothy L Thomas notes that
477230	481570	Russians perceived the Cold War as a war of information in which the West
481570	484350	conquered the Soviet Union. So there's this deep
484350	488030	sense that information had been weaponized against them, and it
488030	491310	was fair play to weaponize it back against the West.
491470	494830	So there are different concepts that we'll be talking about today, and they
494830	497930	exist within fairly distinct domains that all sort
497930	501370	of have overlapping Venn diagrams, although my Venn
501370	505490	diagrams are quite overlapping, but those involve information and
505490	510190	influence operations, which are often confused with this information. That is
510190	512590	the state-sponsored collection of tactical
512590	516550	information about an adversary, as well as the dissemination of propaganda in
516550	521330	pursuit of a competitive advantage over an opponent. So it's very systematic
521330	525050	and very strategic. Disinformation is deliberate, usually
525050	527970	state-sponsored, false information used to mislead
527970	532870	and deceive. Cybersecurity is a completely different, separate
532870	537270	domain, and that is the domain of security that protects networks, devices,
537270	541170	and data, as many of you know. But there's also this sort of subset
541170	545770	that has become a big part of this discipline, which is what I
545770	549350	and others have called cyber-enabled disinformation,
549350	552650	and that's using digitized methods to spread
553290	559470	deliberate false information intended to deceive. Some of the regulations and
559470	563870	authorities that govern these domains are Title 50 of the NDAA,
563870	567350	which proposed international standards to U.S. federal regulations,
567350	570390	and then there are several other authorities that guide information
570390	575390	operations in the intelligence community, throughout international law, within the
575390	581130	State Department that they rely on, and a number of other executive agencies.
581250	585150	We are just going to discuss the global anti-disinformation and U.S.
585150	588930	anti-disinformation regulatory efforts, not sort of the broader frameworks which
588930	593390	exist. So this brief history of Russian and
593390	597350	Soviet disinformation. In the 1920s and 1930s, the Soviets created
597350	601130	an enormous influence in intelligence apparatus across the globe.
601130	604670	They were poor, they were relatively weak during that time, but they
604670	608990	built these organizations, some of which were overt, some of which were covert,
608990	612270	throughout the world, that were able to challenge all the major powers of Europe,
612270	616350	and that the United States and most, without the knowledge of the United
616350	620850	States and most of Europe. They used this apparatus, it was called,
620850	625230	to accomplish a lot in the 1970s and 1980s.
625270	630430	They were nearly able to split Europe and split NATO in Europe in the 1980s,
630430	634510	and they began those efforts in the last year of the Carter administration, and
634510	637530	continued those efforts into the Reagan years.
637850	642890	When communication information was digitized, Russia's functional
642890	646890	approach to monitoring and manipulating information didn't change.
647150	651990	It actually just accelerated it and made it faster and more efficient.
652430	656530	But in 1981, Reagan established the Active Measures Working Group to fight
656530	659710	back against the global Soviet subversion efforts.
659710	666590	This was a really enlightened approach. The Active Measures Working Group
666590	670370	was created as an interagency working group, so it was chaired by the State
670370	672930	Department, but it included representatives from
672930	676410	what was then called the U.S. Information Agency. We don't have one
676410	679630	anymore, but I actually think it's quite an important institution.
679830	686270	The CIA, the FBI, the DIA, the DOD, and the Arms Control and Disarmament
686270	689290	Agency. All of these groups came together to
689290	692650	counter Russian disinformation efforts around the world,
692650	696790	and they realized that this was a really complex
697690	701330	problem, and it required a multi-layered approach.
701470	705190	So despite the public interest in the Active Measures Working Group and U.S.
705190	707850	successes, because it actually received quite a lot
707850	712730	of positive responses from the U.S. public, Americans really liked
712730	716690	this effort, but the Soviet Union continued to successfully
717750	720430	distribute disinformation. Some examples of that,
720430	725050	of those successes include the U.S. claims and beliefs that were spread all
725050	728170	over the world that the United States military had
728170	731830	created AIDS and released it as a weapon. That story
731830	735670	gained considerable traction throughout the world. By the end of 1985,
735670	741030	there were articles published in 13 countries that made these claims.
741070	745430	In 1986, it hadn't reached 50 countries, so one year later.
745430	750610	By 1987, the story had been published over 40 times in official Soviet press
750610	754090	and was reprinted or rebroadcast in 80 countries
754090	758290	in over 30 different languages, and they didn't retract the story
758290	764890	until 1987, but it had already, you know, done its damage quite all over the world.
764890	769210	In January of 1987, the Soviets launched another disinformation campaign, so as
769210	771970	soon as they retracted that one, they started a new one,
771970	776170	or earlier they started a new one that was aimed at convincing people that the
776170	779390	CIA had perpetrated the November 1978 mass
779390	784250	suicide at Jonestown, Indiana. They also ran false allegations of the
784250	787910	United States development and use of biological weapons, and that
787910	791090	the United States was importing Latin American children, butchering them, and
791090	793570	using their body parts for organ transplants.
793570	797650	These stories ran repeatedly in the Soviet press and were picked up worldwide.
797650	800570	We'll see how this is similar to events today.
800570	803930	So there's the pre-digital Soviet disinformation
804650	808130	method and the post-digital toolkit, and they are actually
808130	813230	quite similar. So the pre-digital toolkit, they used a lot of forgeries.
813370	815870	They often use them to discredit or malign
816490	819630	influential figures, particularly those affiliated with the United States
819630	823830	Information Agency. In a report to Congress in 1987, it noted
823830	827110	that the Soviet Union had mailed a forged letter to the Washington Post
827110	831070	and the U.S. News and World Report, who then picked up those stories and ran
831070	833390	with them. The document purported to be a letter
833390	836930	between U.S. Information Agency official Herbert Romanstein
836930	842470	to Senator David F. Durenberger, who was a former chairman of the Senate Select
842470	847410	Committee on Intelligence, or SISI. The letter, dated April 29, 1986,
847410	851210	described an alleged United States Information Agency campaign to spread
851210	854890	this information on the Chernobyl nuclear power plant disaster.
854890	859150	It was designed to discredit U.S. government and damage our relationships
859150	863830	with Europe. They also used a lot of PR firms.
863830	867050	Back in the 1980s, the Washington Post reported that Moscow had approached
867050	871190	several PR firms in the United States to help represent their narratives to
871190	874590	the U.S. public. They relied significantly on
874590	877050	amplification. Disinformation narratives would be
877050	880790	circulated domestically and infringe publications and then slowly move toward
880790	883850	the mainstream publications, like the Washington Post and U.S. News and World
883850	889030	Report and previous examples. There was a lot of media manipulation,
889030	892950	the cultivation of reporters, getting reporters to pick up stories,
892950	898090	investigate, and report on them. There were a number of
898090	901150	front organizations. They were established to look like
901150	905130	legitimate organizations, but they actually had disinformation purposes.
905410	909670	Then there's the Post Digital Toolkit, which is actually very similar. Again,
909670	913750	they're utilizing amplification, PR firms, forgeries,
913750	917810	media manipulation, and front organizations. As you can see, this
918610	924570	clip is from Twitter, and it was when the Russian Ministry of Foreign Affairs
924570	929490	was accusing a white helmets worker of being
929490	936150	an agent of Britain's MI6. And they continued to perpetuate this
936150	939490	false information and actually did quite a lot of damage to him.
940870	945750	This has some contemporary references. So, coronavirus and COVID-19,
945750	951530	some recent examples related to a Chinese government official
953170	957070	starting to circulate the narrative that the
957070	961470	United States military brought the epidemic to war,
961470	964550	in spite that being debunked by a number of other
964550	969010	sources. Reuters reported on disinformation
969010	972290	campaigns by Russia, Russian state media, and pro-Kremlin
972290	977110	outlets regarding COVID-19. And they really
977110	981910	pointed out that the aim of the Kremlin was to aggravate public health crisis
981910	985370	in Western countries, in line with the Kremlin's broader
985370	988370	strategy of attempting to subvert European societies.
988370	994090	Again, it has a long history of this. We also saw other disinformation
994090	997770	on platforms like Twitter. This is an example
997770	1003530	of the Chinese Communist Party capitalizing on the real rise in
1003530	1006070	racism against Asian Americans in the U.S.
1006070	1009450	Apparently there were a lot of videos of Asian Americans
1010170	1012850	saying that there was a Chinese American brigade
1012850	1017490	had had to be formed because violent white riots were attacking
1018090	1021590	Chinese Americans in Los Angeles. This was proven
1021590	1025310	false, although obviously there is quite a bit of racism being
1028330	1031630	directed toward Asian Americans, unfortunately.
1032490	1036250	Computational influence and digital disinformation. So what do we mean by
1036250	1040310	that? It's kind of a word salad. So it's obviously not just
1040310	1043590	Russia. Every state actor gets involved in this
1043590	1048110	type of information operations. It's Russia, China, India, Iran, Pakistan,
1048110	1051970	Saudi Arabia, and Venezuela have all been identified by social media platforms
1052570	1055770	as being engaged in these methods targeted at other
1055770	1059430	states. And they're not just doing it to the U.S. They do it to each other.
1059430	1065110	It's a global effort. And the things that the platforms have
1065110	1067830	pointed out are the amplification efforts,
1067830	1071370	where they use artificial amplification and media
1071370	1075030	amplification. So those are artificial amplification is when you take
1075630	1079870	a bot or you use some sort of scripted algorithm to
1080650	1085550	make it seem as if something is more popular than it actually is or has a
1085550	1089310	broader audience than it actually has. There's media amplification, so where
1089310	1094050	something starts out marginally as a small story on a blog or
1094050	1097110	website and eventually is migrated through
1098590	1103950	manipulation into more mainstream media forms. There are bot
1103950	1107430	farms. And what bot farms? I'll go into those a little more in a
1107430	1112190	moment. Astro-turfing, troll farms, dark ads, deep fakes,
1112190	1115190	fake accounts, either sock puppets or social bots. Again,
1115190	1119430	the terms and language to describe this type of behavior is evolving as this is
1119430	1122530	sort of a new space. And then this concept of
1122530	1126730	brigading. I'll go into those a little bit more detail in the next slides.
1126730	1129290	So fake accounts, those are quite popular
1129290	1135290	on online platforms. In November of 2019, Facebook grew 5.4 billion accounts that
1135290	1138210	said were fake. It reported up to five percent of its
1138210	1142370	monthly user base, so nearly 2.5 billion were fake accounts.
1142670	1146770	There are a number of sock puppets, which is an online identity used for the
1146770	1151050	purpose of deceiving. So it looks like it's a real person and
1151050	1155290	then it isn't actually. The CEO of Whole Foods
1155290	1158990	was convicted of engaging in this behavior in 2007.
1158990	1161990	The CEO of Hollinger International was found guilty of mail fraud and
1161990	1168070	obstruction of justice as well. The social bots are sometimes
1168070	1171450	described as algorithmic software programs designed to interact with humans,
1171450	1174090	so like chatbots, but in this case they often
1174090	1179190	have more autonomy. And those aren't always nefarious, but
1179190	1181470	sometimes they can be when people don't know
1181470	1185950	what they're interacting with. And much of this can sometimes be
1185950	1190050	very positive, really great, it's just oftentimes when it's used with a
1190050	1195810	nefarious or manipulative intent it becomes problematic. So
1195810	1200450	this is a quick clip of a video made by an American YouTube channel
1200450	1204210	called cleantv.com and it was reposted by a Russia-linked Facebook page called
1204210	1206730	Secured Borders. And so you see a lot of
1206730	1212950	cross-platform pollination as well with these. So amplification, this is a
1212950	1214090	another area where there's a lot of studies that are going into
1214090	1217750	how artificial amplification, so when you
1217750	1221410	take information or narrative and you use a
1221410	1225330	scripted method to distribute it more widely than it
1225330	1229210	than it normally would, and that's often used
1229210	1232890	often by using fake accounts or bots which aren't even
1232890	1238270	real accounts. There's media or platform amplification like I discussed before
1238270	1240310	where, you know, it migrates from fringed
1240310	1242050	platforms to mainstream media platforms. An example
1242050	1246110	of amplification having really dire consequences is
1246110	1253750	the case of Facebook in Burma. And so the Rohingya Muslims in
1253750	1257310	Burma and Myanmar were driven out of the country. They were raped and slaughtered
1257310	1260110	by the military in a genocide that was orchestrated
1260110	1262990	through artificial amplification of this information. So it was
1265110	1268470	and some of it was done by the military. They were creating fake accounts
1268470	1270610	spreading false information about the Rohingya
1270610	1274890	and Facebook wasn't able to shut that down before
1274890	1278290	many of them had been slaughtered.
1278770	1281590	Bot farms and wet bot farms, those are
1284290	1289390	they're entities that are created by a scripted behavior that enable machines
1289390	1293330	to do rote operations to upvote or download music or videos or products
1293330	1297450	online or to otherwise automatically create the false impression of popularity
1297450	1300510	or the false impression of an audience that may not actually
1300510	1306370	exist. Wet bot farms are people who engage in similar rote operations to
1306370	1309330	accomplish a task like upvoting music or downloading videos. So
1309330	1312950	it's not a script that's running, it's an actual person that's following
1313470	1318870	direction. And those two play a particularly destructive role when used
1318870	1322670	to falsely amplify messages that are destructive, but it's
1322670	1326230	also a false form of approval. So you may not, you may
1326230	1331990	purchase a product on Amazon thinking that it has x
1331990	1335530	numbers of positive reviews when many of those reviews might not actually be
1335530	1339150	positive or a piece of music may seem incredibly
1339150	1343230	popular, but like here's an example.
1343910	1350330	So these are all cell phones that are playing music or
1350330	1354130	they're downloading apps or they're upvoting music.
1354910	1358130	But as you can see, these aren't actual people
1358130	1364790	connected to those. It's a bunch of cell phones that are doing
1364790	1368030	it with a scripted behavior that's connected to all of them.
1371270	1376550	So troll farms and brigading. You can use bot farms, but you can also use
1376550	1382010	sock puppets, which is a sort of new term, but Oxford researchers called fake
1382010	1386030	armies of fake online influencers manufactured
1386030	1389870	consensus. So that's when it looks like a ton of
1389870	1393070	people agree or think one thing about something,
1393070	1397670	but it's actually not a ton of people. It's a fake army of
1398330	1403450	influencers. Troll farms usually refer to state-sponsored anonymous accounts for
1403450	1406190	stock puppets or bots that engage in biased
1406190	1408510	commentary. Brigading, that's when they can
1409430	1414210	identify a target and gang up on them or that attempt to drown out online
1414210	1419370	commentary by sheer volume through harassment or other methods. And
1419370	1422990	brigading is an online harassment technique.
1422990	1426310	There's a vote brigading as well. It's a massively coordinated online voting
1426310	1430770	either with scores or approval ratings and
1430770	1435050	it creates a false impression of approval where there maybe isn't
1435050	1440330	such an impression. And there is often tied to what people call perception
1440330	1444210	hacking. So there's astroturfing as well. This
1444210	1447150	was a term coined in 1985 by Senator Lloyd
1447150	1450810	Vincent of Texas and it occurs both online and offline. It's a political
1450810	1454830	activity designed to appear as if it's
1454830	1458890	unsolicited or autonomous political engagement. So people will be
1458890	1463890	paid to express their opinions, paid to show up at a town hall, paid to
1463890	1466510	create the impression of an organic grassroots effort when
1466510	1471210	in fact it's not that. Several American corporations and political campaigns
1471210	1475710	have engaged in astroturfing and it's often difficult from an
1475710	1478330	intellectual, academic, or practical perspective to
1478330	1483190	distinguish it from certain types of advertising. There
1483190	1486770	is this concept called dark ads and what it is
1486770	1491050	are precisely targeted ads that don't show up on a user's timeline or feed
1491050	1495450	organically. Facebook invented them but all platforms use them. So following
1495450	1498570	Cambridge Analytica and blowback from the platform's role in the Brexit
1498570	1501630	campaign, Facebook and Twitter developed an ad transparency tool
1501630	1505690	that allows all ads run on the platform to be visible.
1505770	1509770	Targeted online advertising, algorithmic bias, and discrimination are highly
1509770	1513750	problematic. And we have examples of these. They'll
1513750	1516690	create a psychographic profile of someone. So if you see
1516690	1522170	here in this slide, you can drill down the specific type of
1522170	1525410	consumer that you want to advertise to or political
1526710	1530870	participant that you want to target by saying a French and English speaking
1530870	1533930	woman ages between the ages of 31 and 56
1533930	1536770	located in the 10 mile radius of Boston, Massachusetts
1536770	1540370	who works either from home or from a small office in the retail production
1540370	1543330	industry. I mean if you look through this, this drills down to their
1543330	1546030	their fit moms and green moms. They have great
1546030	1550570	grade school kids. They live in a condo down to the exact square feet of that
1550570	1553270	condo. What they enjoy doing for their
1553870	1557090	activities. And you can get even to the types of
1557090	1561130	travel apps and specific types of travel that are on their phone and that they've
1561130	1563770	used. And this is a level of specificity that
1565010	1569450	a lot of consumers aren't aware is being used against them to target
1570010	1574810	ads to them. There's this other concept of deep fakes, shallow fakes.
1574810	1578490	So deep fakes use artificial intelligence or fake videos or photos of
1578490	1582090	real people. And it often uses neural network AI.
1582090	1585650	There's three types. There are three types. Generative,
1585650	1590210	adversarial networks, GANs, autoencoders, and VAEs, variational
1590210	1594910	autoencoders. Google's DeepMind showed that the VAE
1594910	1598530	could outperform GANs on face generation.
1598530	1602390	Variational autoencoders are capable of both compressing data like an auto
1602390	1605510	encoder and synthesizing data like a GAN. However,
1605510	1608750	GANs generate data in fine granular detail and images
1609330	1614570	created by VAEs tend to be more blurred. Shallow fakes are doctored videos that
1614570	1617830	are less dramatic like the speaker Pelosi video.
1618490	1621030	And what researchers have been telling us is that
1621270	1624210	a lot of the time what the hardest part about deep fakes actually
1624210	1629990	often isn't the images but the voices and the sounds and getting
1629990	1634810	those to mimic the actual intonations. Here's an example
1634810	1638290	of a deep fake. At the beginning, before anything, you get
1638290	1642610	together and you read through the script. And so it's like, you know, all these
1642610	1646250	heavyweights like, you know, Ben Stiller, Jack Black, Robert
1646250	1649030	Denny Jr. Everybody at the end is like me.
1649030	1652410	You know, like, hey, happy to be here, guys.
1654010	1657450	And some other supporting guys. And then Tom Cruise walks in
1657990	1662070	and even those guys are like, whoa, and he's super stoked to be there.
1662110	1668010	You know, he's like, yeah, oh, oh, you know, like, he's like, wow.
1669670	1675010	He's immediately excited when he walks into a room.
1675010	1678590	And so he comes over and he sits next to me and I think he had been
1678590	1681190	briefed on some of the supporting guys, but
1682090	1686690	he was like trying to place me, you know. So he sat down next to me. He's like, I
1691630	1692950	love your work.
1694870	1699050	And I went, oh, thanks. I love your work, too, Tom Cruise.
1701170	1703410	So as you can see, it's a very impressive
1705870	1710370	manipulation of that media. So some of the technical issues with
1710370	1713530	addressing this information, as considered by Congress,
1713530	1719250	are the identity validation piece, financial transactions, spoofing, VPNs,
1719250	1724730	bot detection technologies, SAM detection, and sentiment analysis,
1724730	1732030	network analysis, and behavior analysis. I'll just briefly...
1732030	1736890	I think all of these involve constitutional rights. So identity
1736890	1740230	validation, forcing individuals to validate their
1740230	1743870	identity online, has a lot of benefits for a variety of groups, but also has a
1743870	1746430	lot of problems for those who believe in the
1746430	1750230	First Amendment right to anonymity online. Financial
1750230	1753250	transactions are difficult because they're layered
1753250	1756590	on many of these platforms, so it's not always clear who made the payments and
1756590	1760450	where they came from. Another problem that members of
1760450	1764130	Congress thought, well, if you just identify the individual where they are
1764130	1768290	based, are they in the U.S., are they in the U.S., or are they in, you
1768290	1772270	I've had a number of members say, like, if I'm in engaging with somebody, I want
1772270	1774270	to know if I'm talking to an American or if I'm
1774270	1778710	if I'm talking to a Russian operative. Well, the problem with that is that you
1778710	1782010	can't always tell. There's spoofing, you can use VPNs,
1782450	1786030	and people all over the world use these. Bot detection technologies have
1786030	1789250	developed considerably. There is an enormous amount of,
1789250	1792470	depending on how you define bot, but there there's an incredible amount of
1792470	1795430	work that has been done in this space, and the techniques are very
1795430	1800290	sophisticated, but at the same time, things get through. There's also spam
1800290	1804530	detection and sentiment analysis. These also involve constitutional
1804530	1809810	considerations given the privacy issues involved in
1809810	1814750	sentiment analysis, and that's where certain types of language can be,
1814750	1818010	and behavior online can be analyzed to assess whether or not you
1818010	1821090	are positive towards something or negative. It works really
1821090	1823690	well with some of the targeted advertising.
1824450	1827050	Obviously, network and behavioral analysis, those are
1827050	1832070	those are ways to look at the kind of broader infrastructure in which some of
1832070	1835770	this activity is happening, and Congress does consider it when
1835770	1838530	they're thinking about bills and ways to control some of this,
1838530	1843530	some of the problems that are created by some of this behavior online.
1844250	1847990	So there are a lot of First Amendment issues with addressing disinformationist
1847990	1851210	content, and so I think going after the
1851210	1854770	content on these platforms is never the right approach. Doing a
1854770	1859770	content-neutral approach is always best, if possible, because of
1859770	1862190	the First Amendment. So the First Amendment issues involved in regulating
1862450	1865010	disinformation online include the right of the users,
1865010	1868910	but also includes the right of the companies, and it protects,
1868910	1872990	the First Amendment protects anonymity. It protects against compelled speech. The
1872990	1877930	government can't make you say anything. So often, companies will fight disclosure
1877930	1880390	laws that are often well-intended efforts at
1880390	1883810	transparency, but because the government can't compel you
1883810	1887970	to speak about something, they'll fight it. SCOTUS has historically
1887970	1891370	allowed greater regulation of commercial speech, but since the 70s, it has
1891370	1895950	been increasingly protective of commercial speech, which has been an
1895950	1898870	interesting development. And SCOTUS, the Supreme Court of the
1898870	1901770	United States, has sometimes upheld laws that regulate speech
1901770	1906010	if it's part of a larger regulatory scheme focused on conduct,
1906010	1910790	and only incidentally, verbal speech. It's also allowed regulation of speech
1910790	1913770	in a commercial context if there's a reasonable government interest in
1913770	1918590	compelling factual and uncontroversial information. So I say
1918590	1922490	that addressing disinformation is a security rather than
1923110	1927450	a content problem. So over the history of cybersecurity and infrastructure
1927450	1931110	security, we've developed this perimeterless
1931110	1933630	security. So organizations realize that traditional perimeters
1933630	1937310	for information security, like firewalls, signature-based anti-malware,
1937310	1940250	those approaches were becoming less effective, particularly as you have a
1940250	1944050	more mobile workforce. So traditional cybersecurity defenses
1944050	1947770	leave organizations vulnerable to what many call the Maginot Line
1947770	1951370	problem. And the Maginot Line was a military
1951370	1956450	work of genius. It was this wall that was supposed to surround
1956450	1960070	France, and everyone thought it was impenetrable,
1960070	1963610	but the bottom piece was supposed to be this forest that nobody could
1963610	1965890	get through, but the Germans just went around the wall.
1966350	1970290	And in many cases, organizations would design their cybersecurity
1970290	1973730	infrastructure in such a way that they had, well, we have the best firewalls,
1973730	1976770	we have the best security, and then an adversary would just go
1976770	1981490	around it or move laterally within it. So I think that content and
1981490	1985550	speech is a Maginot Line, that when we attack content or narrowly-scoped
1985550	1988750	methods of deterrence without thinking about the infrastructure or the
1988750	1991890	consequences, I think state actors can simply go
1991890	1996970	around our defenses. And I also think it looks like when
1996970	2000630	some of the legislation considered to address some of these problems can often
2000630	2003790	look like the authoritarian laws we have seen
2003790	2006830	in other parts of the world. And I'm going to briefly go over those.
2007870	2011990	So global regulation of disinformation. There are 54 countries
2011990	2014990	have introduced legislation to address disinformation online.
2014990	2018210	16 of them have enacted or introduced some form of fake news or
2018210	2023850	misinformation laws. France, Belarus, Bangladesh, China, Kenya,
2023850	2030230	Burkina Faso, Malaysia, Cambodia, Vietnam, Thailand, Egypt, Germany,
2030230	2033890	India, Myanmar, Singapore, and the United States.
2034210	2036510	So France's... I'm going to go over just a few. I'm not going to make you go
2036510	2039150	through all these countries. I'll just go through a few. But France's
2039150	2043350	disinformation law emerged as a number of disinformation
2043350	2047470	efforts were directed toward the French president.
2047470	2051810	In 2018, they passed a law that provides a definition of fake news, which is
2051810	2056150	inexact allegations or imputations for news that falsely reports facts
2056150	2059470	with the aim of changing the sincerity of a vote.
2059470	2063570	It's designed to enact strict rules on the media during electoral campaigns and
2063570	2066610	more specifically in a three-month proceeding in the vote.
2066910	2071470	They made changes to the draft law in July 2018 to account for satire.
2071470	2074730	So as you can see, like, satire would have definitely fallen under
2074730	2078170	some of those restrictions, so they had to make a change.
2078470	2082070	The legislation gives authorities the power to remove fake content spread via
2082070	2085550	social media and block the sites that publish it, as well as enforce more
2085550	2088290	financial transparency for sponsored content.
2088330	2091830	In the three months before the election period, it builds upon an 1881 law that
2091830	2094970	outlines dissemination of false news. There's a long history of
2094970	2097730	false news in the world, as well as disinformation.
2098690	2101870	As you can see, it has three major provisions and it borrows from
2101870	2105170	the Honest Ads Act, actually, of the United States. So what's also interesting
2105170	2108270	is that a lot of legislatures around the world, whether
2108270	2111490	they're democratic or not, will borrow from each other's
2111490	2114830	legislation. And in this case, they use some provisions from the Honest
2114830	2119030	Ad Act to apply existing standards for TV and radio and apply them to social
2119030	2121290	media, which I actually think is a fantastic idea.
2122310	2126130	It allows political candidates to sue for removal of contested material,
2126130	2129730	but again, because it is a restriction on speech, it is hot...
2129730	2133370	the whole bill is hotly contested. Singapore has an anti-
2133370	2138770	misinformation law, and this one criminalizes the dissemination of false
2138770	2141030	information online. It is one of the more comprehensive
2141030	2145510	and aggressive pieces of legislation in the world.
2145550	2149310	It passed 72 to 9 in Singapore's parliament, and it makes it illegal to
2149310	2151850	spread false statements of fact in Singapore
2151850	2155610	that compromise security, public tranquility, which I find
2155610	2158650	particularly problematic, public safety, and the country's
2158650	2163350	relations with other nations. It punishes people who post false
2163350	2167190	information with heavy fines and even jail time.
2167550	2171590	This law has been condemned by a number of human rights groups and
2171590	2174090	publications for unduly limiting free speech.
2174090	2176650	It lets the government demand publication of corrections alongside
2176650	2180290	allegedly false claims. It also outlaws the spread of
2180290	2183610	misinformation on private messaging apps and gives the government the power to
2183610	2186290	remove false content that undermines public trust, so it increases
2186290	2189890	surveillance tenfold, although it's obviously a
2189890	2194010	surveillance state as it is. It is quite comprehensive, but what's
2194010	2197730	also problematic is that I found in the law itself it utilizes
2197730	2202590	terms that were published by the social media platforms, things like
2204110	2207570	coordinated inauthentic behavior, CIB. That type of
2207570	2210990	language originates with U.S. companies and then it's adopted
2210990	2215670	by foreign states for their legislations to regulate behaviors in perhaps a way
2215670	2218730	that maybe the social media companies weren't necessarily intending.
2220410	2224070	The U.S. regulatory efforts on disinformation,
2224070	2227670	because of all the constraints that I mentioned before, the complexity of the
2227670	2231810	language issues, the different domains that they operate,
2231810	2234970	there are a number of ways why it's been harder for the government to
2235690	2239710	legislate on some of this activity. First of all,
2239710	2242790	when it comes to social media companies, the government is...
2244190	2246790	the social media companies are not the government.
2246870	2250010	They're not violating the First Amendment by imposing restrictions on
2250010	2253430	speech. It's when the government forces a social media company to impose those
2253430	2257270	restrictions that there's a lot of legal problems that Dr.
2257270	2259230	Matwishan could probably elaborate on much better than
2259230	2264190	I could. Some of these provisions are the Countering Foreign Propaganda and
2264190	2267290	Disinformation Act. That was included in the National
2267290	2274750	Defense Authorization Act in 2017. The H.R. 5910,
2274750	2278350	Defend Against Russian Disinformation and Aggression Act.
2278410	2282470	We have the Honest Ads Act, the Deepfake Report Act, the Malicious Deepfake
2282470	2286730	Prohibition Act in 2018, and Defending each... this is a
2286730	2291650	deepfake, so they turned it into an acronym, which is quite clever.
2291650	2293490	Again, Congress wants to act on some of these
2293490	2297270	bad behaviors that are having negative consequences,
2297270	2300830	and they've been doing a lot more in the last few years.
2300830	2306430	But again, it's quite complex. So this bill, Countering Foreign Propaganda
2306430	2310630	in the NDAA, that was introduced by Senator Rob Portman and Senator Murphy.
2310630	2314310	The bill created a grant program for NGOs, think tanks, civil society, and
2314310	2316670	other active groups outside of government who are engaged in
2316670	2323410	counter-propaganda-related work. I actually think we need to do... this
2323410	2327290	great under the State Department, but I do think we need some form of a
2327290	2331210	U.S. Information Agency, just to take a more holistic approach,
2331210	2335310	so that it requires that all executive agencies,
2335310	2340410	like the former Working Group, come together and consider solutions
2340410	2347190	for this ecosystem in a coordinated manner.
2347190	2350770	We had the Honest Ads Act, as I mentioned, adopted by France. It was introduced by
2350770	2355290	Senator Klobuchar, Senator Lindsey Graham, and Senator Warner in 2018.
2355330	2358990	And it helps prevent foreign interference in election advertising.
2359010	2362130	And it amends the definition of electioneering communication
2362130	2366630	in the Bipartisan Campaign Reform Act of 2002 to include paid internet and
2366630	2370170	digital advertisements. A lot of these problems are a result of
2370170	2374950	old legislation not being updated for new technologies. I encountered this
2374950	2381390	early on in my career at a studio in Hollywood. They had
2382090	2386030	a whole framework for television and music rights,
2386030	2390870	but that was pre-digital. And when we had introduced streaming and downloading,
2390870	2394070	all the licenses that applied to television shows,
2394070	2398770	movies, their music that accompanied them, those were all completely outdated.
2398770	2402950	So when we started analyzing that, and how do you... you can't go through and
2402950	2407310	renegotiate every single license. Most of the studios in Hollywood, the one
2407310	2411390	I worked at, but as well as many others, renegotiated those licenses based on a
2411390	2415630	framework that looked at the new media technology landscape and said
2415630	2421870	a download is equivalent to a VHS, for example, and
2421870	2425470	streaming is equivalent to a broadcast license.
2425470	2428410	So they were able to expedite some of the framework,
2428410	2431650	expedite some of the licensing in that way. But I think a lot of legislation
2431650	2436030	in Congress right now could be expedited if we simply
2436030	2439550	updated some of the older legislation for a new
2439550	2443370	technology environment. Because as you know, technology moves very, very quickly.
2444730	2447110	So yeah, these are the other requirements.
2447170	2451150	And it also, you know, required them to make every reasonable effort to ensure
2451150	2453310	that foreign individuals and entities are not purchasing
2454050	2457670	political advertisements in order to influence the American electorate.
2457670	2461510	Seems like a small ask, but as again, the purchasing
2461510	2465650	piece of this is quite difficult sometimes online, trying to validate
2465650	2470210	who's buying what and how. The Deep Fakes Report Act was passed in
2470210	2472530	the Senate by unanimous consent, which means that
2472530	2477450	it was introduced and everyone, something that passes by unanimous
2477450	2480010	consent, if no one objects, then it passes.
2480090	2483530	And it was passed by Senator Portman, Schatz,
2483530	2488730	Joni Ernst, Martin Heinrich, Senator Gardner, Senator Peters, Senator Rounds,
2488730	2491870	and Senator Hassan. And that required the
2491870	2494850	Department of Homeland Security to publish an annual report on the use of
2494850	2498290	deepfake technologies that would be required to include an assessment of how
2498290	2500590	both foreign governments and domestic groups
2500590	2504790	are using deepfakes and digital forgeries to harm national security and
2504790	2508770	mislead the American people. Now that's just a report, and Congress will do this
2508870	2512550	a lot. They'll issue a... they'll pass something that requires an
2512550	2515790	executive agency to create a report to help inform the public a little bit
2515790	2516590	better.
2520590	2524110	So this is the Malicious Deepfake Prohibition Act. It was introduced by
2524110	2528290	Senator Ben Sasse in 2018, and it was supposed to create a new
2528290	2531550	criminal offense related to the creation or distribution of fake electronic media
2531550	2534490	records. It was criticized at the time for being
2535130	2540550	sloppy and poorly thought through, but in fairness to them, you know, these
2540550	2545350	are brand new concepts and ideas and, you know,
2546390	2549250	there may be flaws, but the... but I do think that
2549990	2554370	Congress just needs better resources to help them inform their decisions.
2556210	2559690	There's the Defending Each and Every Person from False Appearances by Keeping
2559690	2562890	Exploitation Subject to Accountability Act of 2019.
2563010	2567310	This was... would require intentionally deceptive content creators to label
2567310	2570350	videos with the digital watermark and written disclaimer informing
2570350	2572930	its viewers that the content has been manipulated.
2573690	2578010	That is... it does provide a legal course of action against content creators while
2578010	2579650	also giving people who have been portrayed
2579650	2582470	in deepfake videos a private right of action.
2583670	2587150	Some of this was considered unenforceable, as
2587150	2592290	we go into that. The Defend Against Russian Disinformation Aggression Act.
2592290	2594410	This bill has included a package of bills in the House
2595630	2599470	to secure America from Russian Interference Act of 2018, and it
2599470	2604110	includes 17 bills to address subversive Russian activities.
2604130	2606590	Congress... when people say Congress doesn't do anything, it's not entirely
2606590	2609190	true. They wrote 17 bills to try to address
2609190	2612830	the problem. It included legislation to codify the
2612830	2616150	State Department Sanctions Office, and it required reporting on Putin's fake
2616150	2620510	accounts and authorized... enhanced NATO cooperation, which is... I
2620510	2623390	think allied cooperation is really important.
2623390	2627510	The 2020 Technology Legislative Agenda. These are just some of the things that
2627510	2632270	early in 2020 we identified as, you know,
2632270	2635510	efforts that Congress would try to tackle. And this was before COVID,
2635510	2641810	and, you know, another crisis had... a social justice crisis had
2641810	2645050	emerged. So that includes trying to craft a federal
2645050	2648830	data privacy framework, a greater shift toward consumer protection rather than
2648830	2654090	disinformation protection. We... I suspected that House is still
2654090	2657270	actively considering breaking up the... well, they are actively considering
2657270	2660250	breaking up the big technology companies, and you may have seen the hearing more
2660250	2664050	recently. We highlighted COPPRA, the Consumer
2664050	2667610	Online Protection Act. Senator Cantwell torpedoed this a few
2667610	2670670	times in 2018, but the sticking point remains that the private right of action
2670670	2673110	for consumers if platforms misuse their data
2673110	2677850	is a non-starter for Republicans. The House version of the Honest Ads Act will
2677850	2682390	continue to be debated. Senator Warner introduced the Detour
2682390	2686670	Act, the Access Act, and Josh Hawley... and with Josh Hawley, the Smart Act.
2686730	2692150	The Detour Act is about dark patterns. That was to try to
2692150	2696770	address manipulative design on websites.
2696770	2701550	The Access Act was an interoperability bill. The senator wanted to make it
2701550	2704450	easier to move your data from one platform to another.
2704450	2707890	And I think we'll continue to see this movement toward
2707890	2710850	the incremental breaking up of large tech companies and or
2710850	2714690	antitrust reform, but I think the tone of the 2020 legislative agenda
2714690	2718790	has shifted due to COVID and families trying to work from home and relying so
2718790	2722350	heavily on technology. So I just want to ensure that that's
2722350	2728510	probably going to continue to shape the public debate. And that is all I have.
2730890	2732950	There we go. Thank you.
2734490	2739330	Thank you so much, Liesl, for joining us today and for that amazing talk.
2739330	2744750	And Q&A with you follows after this. Thanks so much.